Microsoft Security Essentials MsMpEng.exe using high CPU Time

Microsoft Security Essentials MsMpEng.exe – Antimalware service executable using high CPU Time

I have Windows 7 Ultimate x64, but I think this might be problem in any version. I keep having issues with Microsoft Security Essentials MsMpEng.exe using high CPU Time and hogging the cpu.  Basically, using a large amount of resources, like 100%!  It’s eating the CPU time and a lot of memory.  The system will work just fine, even after running for hours, when suddenly the system slows to a crawl, almost to the point I have to reset the system.  I finally narrowed the culprit to MsMpEng.exe, the scanner for MSSE (Microsoft Security Essentials).

Good news is, I think the cpu hog problem is solved!

I found a link on a Google search about adding exclusions, which I suspected would be a problem for things like my backup programs.  I added Crashplan and Syncback programs already, but what I found in that Google search was that you need to add the MSSE directories in C:\ProgramData to the exclusion list.  WHAT!!???  Are you kidding me?  MSSE doesn’t already exclude itself?  Come on MS!!  I really like MSSE,  but that’s pretty stupid.

I went ahead and added the directories below to MSSE exclusions:
(Be sure you set your system to Show Hidden Files in Windows Explorer, because C:\ProgramData is hidden in Windows 7, and so is the “All Users” profile folder in XP.)

- – For Windows 7 – -

C:\ProgramData\Microsoft\Microsoft Antimalware
C:\ProgramData\Microsoft\Microsoft Security Essentials
C:\Program Files\Microsoft Security Essentials

- – For Windows XP – -

C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware
C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Security Essentials
C:\Program Files\Microsoft Security Essentials

———–

Note:
1. As stated above, make sure you have enabled/showed hidden files.
2. You may need to search your system for “Mirosoft Antimalware” or “Security Essentials” if you do not see the folders listed above.
3. I have not tested this in XP and don’t know the exact locations, so if you don’t see, do a search on your computer.
4. Thank you to several commenters for the extra information regarding XP and other possible locations!

———–

Now, for a couple days, I have had no more issues!!!  We’ll see in a week if it really fixes it.  That’s an easy fix, but completely annoying!  I still like MSSE regardless.  It’s not perfect, but I’d rather have it than anything else.

I am curious to know if anyone else found this fix to work?

Note:  I do recommend people run a manual scan with MalwareBytes and SuperAntispyware once in a while, along with the real time scanner in MSSE.  MSSE didn’t catch a recent trojan at one of my clients, same one was blocking MalwareBytes too.  Only SuperAntispyware cleaned the system properly.

EDIT 02/10/2010:

It’s been about a week and a half, still working fine! It appears that this fixed the problem!

EDIT 02/23/2011:

I have also seen a new setting to scan only when the computer is not in use, which has also helped in some cases. Check out my newer post:

http://www.1stbyte.com/2011/02/23/revisiting-msmpeng-exe-antimalware-service-executable-high-resource-usage/

 

EDIT/NOTES 3/13/2013:

Some very helpful visitors have commented about the paths that may have changed on some systems. I am guessing that’s due to newer versions released since this post.  Anyway, check these paths in your system as noted in the comments.  This person had an XP Home sp3 system.

1) C:\Docs and Settings\All Users\Application Data
\Microsoft\Microsoft Antimalware
2) C:\Docs and Settings\All Users\Application Data
\Microsoft\Microsoft Security Client
3)   C:\Program Files\Microsoft Security Client

Thanks to all of you that have visited and provided “constructive and helpful” comments.

  • Hu

    I tried your tweak that you mentioned and I really hope it will make a difference. Microsoft Security Essentials is a program with a good interface, however, the antimalware service executable is unforgivable. On a regular computer, it will hog the cpu when you are doing any task. Simply opening the explorer window will cause it to rise up to 6 percent and then back to zero.

    Perhaps, your tweak might work because the program is updating itself? If the program is simultaneously updating its definitions and scanning its definitions, it might cause more cpu problems.

    So far, there doesn’t seem to be any issue with this tweak. I’ll monitor the progress of the program for several days and conclude whether there is a difference.

    • http://www.1stbyte.com Greg

      Thanks for sharing your comments!
      I hope that works for you too, and let me know how it works. The other day though, I ended up removing MSSE, because I kept having slow-downs on the system. MsMpEng.exe wasn’t hogging too much CPU, but it was still constantly working, and using around 20% and 120 or more Mb’s or RAM. I have a T9400 CPU and 4Gb’s of RAM, why is MSSE using so much though, and causing my system to hover around 20% CPU usage? I have it running on multiple systems, but just this bogs down my laptop.

      Now, another process I have running and using a lot of time is CrashPlanService.exe. That’s my backup program, which I LOVE! and that hasn’t caused me any issues before, for over a year now. I even excluded that program and data files from MSSE in hopes that it wouldn’t conflict. So here’s the thing, I removed MSSE, and guess what? System hum’s along with very little CPU time. Maybe jumps around at 2% to 5%, with tiny bumps to 10 or 15% once in a while. That’s kind of normal, and the system moves along much more quickly. And yes, that’s with my backup program still running.

      Anyway, hope you have better luck! I’d rather just not use AV than deal with the slow downs. Of course, I don’t think I’ve ever had a virus. Clean lots for my clients, but I know what *NOT* to do!

  • http://twitter.com/r00m r00m

    I have Win7 Ultimate x86 and had the same issues as u guys. Added those directories into the exclusion list and voila – everything comes back to normal. Thanks!!

  • ehidden

    worked 100%. was experiencing high cpu usage from MSMPENG.exe Was watching results in resouce viewer (Vista), added those directories as mentioned. CPU and disk usage dropped to almost zero. Thank you very much.

  • vegtabill

    Greetings! I am trying your tweak on an XP machine. It appears one would need these paths for XP:

    C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware

    and

    C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Security Essentials

    Sound about right? Thanks for this info… very helpful indeed!

    • http://www.1stbyte.com Greg

      I haven’t checked, but that does look correct for XP.

  • Denise C

    Hi there..I too am having trouble with this but when I opened up MSSE there are 3 different exclusions to pick from. I am not really a newbie but when it comes to these stuff I am. So my question:
    Where the hec do I enter this stuff??…LOL
    Please explain in layman terms. IE. go here then go here click on here click on there etc…
    thanks a bunch.

  • asshole

    by “c:\programdata” do you mean “C:\Documents and Settings\All Users\Application Data\Microsoft”? i run winxp and this is the only location i have “microsoft antimalware”.

    @asshole (nice name!)
    Yes, in vista/7 c:\programdata is a hidden/system folder where programs put settings and things, among other things. It used to be “C:\Documents and Settings\All Users\Application Data” in XP, yes.

  • Denise C

    @greg–(or whoever has the correct answer):
    “…what I found in that Google search was that you need to add the MSSE directories in C:\ProgramData to the exclusion list. WHAT!!??? Are you kidding me? MSSE doesn’t already exclude itself? Come on MS!! I really like MSSE, but that’s pretty stupid.

    I went ahead and added these to MSSE exclusions:

    C:\ProgramData\Microsoft\Microsoft Antimalware

    C:\ProgramData\Microsoft\Microsoft Security Essentials

    C:\Program Files\Microsoft Security Essentials…”

    When I open up MSSE, and go to the settings tab, in the box on left hand side there is a list to select from ie,Scheduled Scan, Default Action, Real-Time Protection etc…then there is these three: Excluded Files & locations, Excluded File Types, & Excluded processes….

    My QUESTION is this: Where do I go to add the following–Is it within MSSE??–If not, where?:

    C:\ProgramData\Microsoft\Microsoft Antimalware

    C:\ProgramData\Microsoft\Microsoft Security Essentials

    C:\Program Files\Microsoft Security Essentials

    I’m sorry to sound so stupid but if you could just lead me in the right direction and tell me what to do step by step I would be forever grateful :)
    Thanks in advance
    Denise C.

    • http://www.1stbyte.com Greg

      @Denise
      Yes, in the Settings tab within MSSE. Click on the left “Excluded Files & Locations”, then add each of those paths to that list. (which is empty by default)

      I hope this helps solve your issues. As of now, I’ve seen it fix a few systems, but not all. Probably because MSSE wasn’t really to blame, though it looked like it was. And I agree, its really stupid! If this truly is the case, that they don’t exclude from their own locations, or that MSSE is bogged down by accessing files in use by its own processes. However, not enough is known to say for sure. Maybe their program knows better even without the exclusions, we don’t know. But if it fixes even one system by adding them, I say try it! It can’t hurt! :)

  • Gracegrace55

    I have went everywhere and looked through everything before coming across your solutions…GOD BLESS YOU!!!
    It was not until I purchased and downloaded iolo System Mechanic that I realized there was an issue within the CPU usage and connected it to MSE.
    System Mechanic would take forever to load, if it loaded at all, then freeze continually, as did other programs. I would have to open task manager and click the option to reveal processes and alternate between windows there for it to unhang momentarily. NIGHTMARE!!!
    I also have a Dell Dimension 9100 that we custom ordered that keeps crashing. I am now wondering if it is not due to this issue. I am off to try this fix there and await the prognosis..lol.
    Thank you for sharing your wisdom and expertise with all of us who are not so gifted in this area. Clearly you have the heart of a teacher, but also that of a leader, ready to lead the way for those like myself who are in the dark concerning the deeper knowledge of computers.

  • roxlet

    Thanks! That worked fine for me, with an only exception. I didn’t found the “Microsoft Security Essentials” folder on both Program Data and Program Files directories. I guess they were replaced by “Microsoft Security Client”. Anyway, I added these to the exceptions and MSSE are not longer using CPU.
    Thanks again for sharing your knowledge.

  • Hitide1

    Thanks for the tip.  It’s been good so far.

  • txgeekygirl

    THANK YOU THANK YOU THANK YOU!!

  • Anonymous

    Thanks. That fixed it.
    WHAT!!???  Are you kidding me?  MSSE doesn’t already exclude itself? 
    Come on MS!!  I really like MSSE,  but that’s pretty stupid.
    That is what happens when MS ships all American jobs overseas to some code-apes in India that barely speak English…
    I just boycott all 7-11s, MiniMarkets, or any place where I see some Hindu or Pakistani in the other side of the counter… My American money is not going to them. Not my fault they didn’t know about condoms or TV and have 2 billion retarded kids to feed. I already suffer too much with all bad-coded apps they make over there…

    • MinistryofMicrosoft

      @colorsdonrun:disqus ,
       As an IT Pro at Microsoft I would like to clarify, you’re comments are simply racist and result of your ineptitude and that of your progenitors, (yes I mean your mama) . 
      First off I am appauled that no one else replied to your irratating comment. I usually don’t but since my employer happens to be MS, and I have seen this problem crop up dozen times on pc I service. Let me be clear american white CEO’s made decisions to go to INDIA,CHINA , BRASIL, to pad their pockets. 
      Don’t blame people for going out and getting jobs. You might want to take a hint. 
      Finally, all API are not just approved by the “apes in india” actually brilliant engineers that they are, they still need approval from HQ, here in US of A. MS does send out crap (see vista) code before its completely checked, but its crap codes work thousand times faster than anything you’ve written sir. I assure you of that, unless your name is Steve Jobs/Wosniack Oh it isn’t oh.. ok. (GSDSU)
      /GO SIT DOWN SHUT UP.

      -Thanks to the OP for actually providing a solution!! 
      Sorry to hijack your page, but filth is filth. 
      Simon Resto MSCE

      • Albert

        @99334b851544d9acb610a9a3d79eb96c:disqus
        if you really are an IT Pro at MS it would have been more helpful if you had contributed to solving the problem!!!

        • world’s greatest orator

          Actually his useless grandstanding while providing no tech support is strong evidence that he works for MS

  • http://twitter.com/handsoncorp Hands Oncorp

    You can try manual removal guide for this problem above
    http://hands-oncorp.com/

  • Kate

    Thanks a lot for sharing. I will test it and let you know.

    Today I was at the verge of doing an uninstall
    because it “abducts” the system ”out of the blue” and takes anywhere between 20-30 minutes to release it.

    So I did what you suggested and excluded the 3 mentioned folders we’ll see what happens.

    Thanks a lot for sharing and only together! :)

  • Jason Everling

    This worked for me! Thanks
    Now the process is sitting around 0-3 instead of 19-48 CPU

  • Darkhaslador

    on xp its client not essentials

  • Jaqalope

    Brilliant! Thanks for the tip.  Working very well after…well…only five minutes, but five blissfull minutes of useable machine is a big improvement.

  • Ksiemb

    Worked for XP. – Occasionally get high CPU, but it is actually updating, then goes away.

  • Alan Moore

    I had my MSSE scans set to run at night when I’m not at my computer.  But for some reason during the day, msmpeng would load up on anywhere from 30 to 80 percent of CPU usage.  It was bad enough that my fan on my heatsink was cranking up to offset the heat!  So when I realized I was hearing my fan but I wasn’t playing GTA IV or running a scan or doing something real intense, I had to check it out.  This is the best description I’ve heard.  If you search on Microsoft’s various forums and answers pages they keep saying, well, you probably have a conflict between MSSE and third party software, or a startup item, or something inane.  MS thinks its software couldn’t possibly ever conflict WITH ITSELF!!!  Love it, thanks for posting, I’ve applied the exclusions and truly hope to not hear my fans full tilt until I become Niko Bellic again!

  • r0g

    Thanks for this – copied and pasted the 3 paths into exceptions, hit Save Changes and instantly msmpeng usage dropped from 25-50% down to 1-2% – very pleased :)

  • tlsirion

    msmpeng.exe had been reading from my external drive several times per second, causing performance and unmounting issues. Your solution has simply and completely corrected this issue. I am very grateful.

    P.S. Big ups to MinistryofMicrosoft

  • BT

    Thanks for the tip. It seems to be working fine so far.

  • SpawnSiviu

    On my PC the real time protection from MSE gives me real trouble!

    Winamp, BSplayer, Firefox and some other programs freeze, not to say that when playing Cabal or World of Tanks (online games) i get disconnected or they close all of a sudden. Found that the best way to get rid of the problem is to add to exclusion:
    C:Program Files
    C:Program Data
    and any other folder containing a game that uses high resources.

    Thank you for your tutorial!

  • http://www.facebook.com/kailasa.ishaya.5 Kailasa Ishaya

    Thanks for the great advice. However, I guess I’m running a different version of MSE, (running WinXP Home SP3) because when I went to look for the MSE software to add to the exclusions, here’s what I found and so I added those instead of the files listed above in the article:

    1) C:Docs&SettingsAll UsersApplication DataMicrosoftMicrosoft Antimalware

    2) C:Docs&SettingsAll UsersApplication DataMicrosoftMicrosoft Security Client

    and

    3)C:Program FilesMicrosoft Security Client

    Thought I’d post these here just in case someone else has the same setup.

    • gregthegeek

      Awesome! Thanks for the shared tips! I’ll add a note to the post. I haven’t used XP in a while and I am guessing the newer versions of MSSE are using different paths since I first posted this.

  • NeXter

    I would like to let you know that since you made this post, the name of the “Microsoft Security Essentials” folders have changed to “Microsoft Security Client” in at least Windows 7. So that’s

    C:ProgramDataMicrosoftMicrosoft Security Client
    C:Program FilesMicrosoft Security Client

    Just wanted everyone to know, so noone gets confused.